1

I have a admin panel for login. I have created a login page with php, html, java script. I used session to pass user to next page. This working perfectly on my localhost. But on live server i am getting problem, its showing me "loged in successfully" popup and redirecting back to login page. When i print session on localhost its showing me session value but on live server its empty. I have searched so many answers and tried same but still it's not working. Please help and thank you for your time and consideration.

My live server is Apache HTTP Server Version 2.2

My connection file db.php is

<?php

/*Default time zone ,to be able to send mail */
date_default_timezone_set('Asia/Kolkata');

//connect database
$con = mysqli_connect ("localhost","rootuser","password","testdbname"); //host, username, password, database name

        //database connect error
        if (mysqli_connect_errno())
        {   
        echo "Failed to connect to MySql: " . mysqli_connect_errno();
        }
?>      

login.php file is

<?php 
session_start();
include("includes/db.php");

if(isset($_SESSION['mysesiuid']))
{
  header('Location: index.php?alreadyin');
  //echo "<script>window.location.assign('index.php?alreadyin')</script>";
}

else
{

?>          

<script src="assets/js/validate/jquery.js" type="text/javascript"></script>
<script>
//login script 
$(document).ready(function() {

    var mazalagna_login_email1 = 1;
    var mazalagna_login_email2 = 1;
    var mazalagna_login_email3 = 1;
    var mazalagna_login_password = 1;

    $("#main_login_submit").click(function(){


        //password
        if($("#mazalagna_pass").val() == ''){
            $("#mazalagna_pass").css("border","1px solid red");
            $("#mazalagna_password_error").show();
            mazalagna_login_password = 1;
        }else{

                if($("#mazalagna_pass").val().length < 6){
                    $("#mazalagna_pass").css("border","1px solid red");
                    $("#mazalagna_password_length_error_longform").show();
                    $("#mazalagna_password_error").hide();
                    mazalagna_login_password = 1;
                }else{
                    $("#mazalagna_pass").css("border","1px solid green");
                    $("#mazalagna_password_length_error_longform").hide();
                    $("#mazalagna_password_error").hide();
                    mazalagna_login_password = 0;
                }
        }



        //email
         var pattern = /^([a-z\d!#$%&'*+\-\/=?^_`{|}~\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]+(\.[a-z\d!#$%&'*+\-\/=?^_`{|}~\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]+)*|"((([ \t]*\r\n)?[ \t]+)?([\x01-\x08\x0b\x0c\x0e-\x1f\x7f\x21\x23-\x5b\x5d-\x7e\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]|\\[\x01-\x09\x0b\x0c\x0d-\x7f\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]))*(([ \t]*\r\n)?[ \t]+)?")@(([a-z\d\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]|[a-z\d\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF][a-z\d\-._~\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]*[a-z\d\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])\.)+([a-z\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]|[a-z\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF][a-z\d\-._~\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]*[a-z\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])\.?$/i;
        var validateMazalagnaEmail =  pattern.test($("#mazalagna_email").val());

        if($("#mazalagna_email").val() == ''){
            $("#mazalagna_email").css("border","1px solid red");
            $("#mazalagna_email_error").show();
            mazalagna_login_email1 = 1;
        }else{
            $("#mazalagna_email").css("border","1px solid green");
            $("#mazalagna_email_error").hide();
            mazalagna_login_email1 = 0;
        }

        if(!validateMazalagnaEmail){
            $("#mazalagna_email").css("border","1px solid red");
            $("#mazalagna_email_error").show();
            mazalagna_login_email2 = 1;
        }else{
            $("#mazalagna_email").css("border","1px solid green");
            $("#mazalagna_email_error").hide();
            mazalagna_login_email2 = 0;
        }

        if(validateMazalagnaEmail){
            $.ajax({   
                    type: "POST",
                    cache: false,
                    url: "php/ajax_email_exist.php",
                    data: { email: $("#mazalagna_email").val()},

                    success: function (data)
                    {
                        if(data != 1){
                            $("#mazalagna_email").css("border","1px solid green");
                            $("#mazalagna_exist_email_error").hide();
                            mazalagna_login_email3 = 0;
                        }else{
                            $("#mazalagna_email").css("border","1px solid red");
                            $("#mazalagna_exist_email_error").show();
                            mazalagna_login_email3 = 1;
                        }

                        if(mazalagna_login_email1 == 0 && mazalagna_login_email2 == 0 && mazalagna_login_email3 == 0 && mazalagna_login_password == 0 ){

                    $.ajax({   
                            type: "POST",
                            cache: false,
                            url: "main_login.php",
                            data: { 
                                    username1: $("#mazalagna_email").val(),
                                    password1: $("#mazalagna_pass").val()
                            },

                            success: function (data)
                            {
                                alert(data);
                                //alert("Welcome! You have loged in successfully!");
                                window.location.replace("index.php");
                            }
                    });
            }
                    }
            });
        }   

        //edit value    
        $(".regval").click(function(){
                var id = "#"+$(this).attr("id");
                var errorId = "#"+$(this).attr("id")+"_error";
                $(id).css("border","1px solid #a39e9e");
                $(errorId).hide();
        }); 


    });
});
</script>

                        <strong>   Enter Details To Login </strong>  

                            <!--    <form role="form" action="" method="post">  -->

                                     <div class="form-group input-group">
                                        <span class="input-group-addon"><i class="fa fa-tag"  ></i></span>
                                        <input type="text" id="mazalagna_email" name="mazalagna_email" class="form-control regval" placeholder="Your Username" required />
                                     </div>

                                     <div id="mazalagna_email_error" style="display:none; margin-top:-12px; margin-bottom:12px; text-align:center; color:red; font-size:12px;">Please enter valid Email</div>
                                     <div id="mazalagna_exist_email_error" style="display:none; margin-top:-12px; margin-bottom:12px; text-align:center; color:red; font-size:12px;">Your email id is not registered.</div>

                                     <div class="form-group input-group">
                                            <span class="input-group-addon"><i class="fa fa-lock"  ></i></span>
                                            <input type="password" id="mazalagna_pass" name="mazalagna_pass" class="form-control regval"  placeholder="Your Password" required />
                                     </div>

                                     <div id="mazalagna_password_error" style="display:none; margin-top:-12px; margin-bottom:12px; text-align:center; color:red; font-size:12px;">Please enter your password</div>
                                     <div id="mazalagna_password_length_error_longform" style="display:none; margin-top:-12px; margin-bottom:12px; text-align:center; color:red; font-size:12px;">Enter min 6 character password</div>


                                     <button type="submit" id="main_login_submit" name="main_login_submit" class="btn btn-primary ">Login Now</button>
                                    <hr />
                                <!--    </form>  -->

<?php } // top else close here ?>           

My main_login.php file is

<?php
//connect database
 session_start();
 require_once 'includes/db.php';
 global $con;

  $user_email = trim($_POST['username1']);
  $user_password = trim($_POST['password1']);

  $password = mysqli_real_escape_string($con, md5($user_password));

    $res = $con->query("SELECT * FROM useradmins WHERE email='$user_email' AND password='$password'");
    $row = $res->fetch_assoc();

      $uid = $row['admin_id'];
      $name = $row['name'];
      $useremail = $row['email'];
      $pass = $row['password'];

    if($useremail==$user_email && $pass==$password){

            $_SESSION['mysesi']=$name;
            $_SESSION['mysesiuid']=$useremail;

            echo "Loged in successfully.";  

    //update status and login time

    date_default_timezone_set('Asia/Kolkata');
        $date_email = date('F j, Y h:i A');  
        $date = date('Y-m-d H:i:s');
        $user = $_SESSION['mysesiuid'];
        $ip = $_SERVER['REMOTE_ADDR'];
        $httpref = $_SERVER['HTTP_REFERER'];
        $httpagent = $_SERVER['HTTP_USER_AGENT'];

        $update_last_login="UPDATE useradmins SET admin_status='ONLINE',active_ip_address='$ip',admin_last_login='$date' WHERE admin_id='$user'";

        $update_last_login = mysqli_query($con, $update_last_login);

    }
    else{
            echo "Unable to login.";
    }

?>

index.php file is

<?php 
session_start();
require_once 'includes/db.php';

if(!isset($_SESSION['mysesiuid']))
{
  header('Location: login.php');
  exit;
}
else
{

?>


<h1>hi success</h1> 


<?php   }   ?>   <!-- top else statement close here -->
sherry123
  • 11
  • 2
  • 1
    Please dont __roll your own__ password hashing. PHP provides [`password_hash()`](http://php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://php.net/manual/en/function.password-verify.php) please use them. And here are some [good ideas about passwords](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) If you are using a PHP version prior to 5.5 [there is a compatibility pack available here](https://github.com/ircmaxell/password_compat) – RiggsFolly Jun 15 '17 at 13:15
  • @sherry123 - Add `error_reporting(E_ALL);` after `session_start();` and tell us what you see... (wouldn't hurt to add it to all php files, at least while you are still developing your application---I wouldn't recommend keeping it on when you go live/to production though) – Rushikumar Jun 15 '17 at 13:19
  • @RiggsFolly thank you for your suggestions. I will make changes for my password. So it will be more secure. – sherry123 Jun 15 '17 at 13:20
  • 1
    Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) – RiggsFolly Jun 15 '17 at 13:22
  • @Rushikumar thanks for your reply. I have added `error_reporting(E_ALL);` after `session_start();`. Its showing me blank screen. – sherry123 Jun 15 '17 at 13:29
  • You dont seem to be redirecting to the I am logged in page when you get a successfull login or am I missing something – RiggsFolly Jun 15 '17 at 13:30
  • @sherry123 out of curiosity, what are the logs saying? Also, it's worth cross checking/comparing your php.ini file that you have locally to that of the server's --- do a quick diff... – Rushikumar Jun 15 '17 at 13:33
  • @RiggsFolly I am using javascript for that in **login.php** file. – sherry123 Jun 15 '17 at 13:33
  • @Rushikumar thanks ... I have to check servers php.ini file and log file. – sherry123 Jun 15 '17 at 13:37

0 Answers0